fix: address final-review findings on the latest-chapter poller

Wires the five poll env vars into docker-compose (the documented kill
switch was inert), skips fetching unknown sites and non-https URLs
before spending a request, and makes runOnce's summary log fire on
empty and cancelled ticks. Records the accepted non-atomic Get+Upsert
window and the one-interval startup delay in the docs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/latest_test.go

@@ -259,6 +259,48 @@ func TestRunOnceCorrectsDownward(t *testing.T) {
 	}
 }
 
+// series_url is client-supplied via PUT /bookmarks/{key}, so checkOne must
+// reject anything that is not a known site with an https URL before spending a
+// request on it — the cooldown still gets consumed either way.
+func TestCheckOneValidatesSeriesURLBeforeFetching(t *testing.T) {
+	tests := []struct {
+		name      string
+		site      string
+		seriesURL string
+		wantCalls int
+	}{
+		{"unknown site", "mangadex", "https://mangadex.org/title/x", 0},
+		{"http scheme", "asura", "http://asurascans.com/comics/x", 0},
+		{"unparseable url", "asura", "http://[::1", 0},
+		{"valid https asura", "asura", "https://asurascans.com/comics/x", 1},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := newTestStore(t)
+			key := tt.site + ":x"
+			if _, err := s.Upsert(Bookmark{
+				Key: key, Site: tt.site, SeriesID: "x", SeriesURL: tt.seriesURL,
+				UpdatedAt: 1000,
+			}); err != nil {
+				t.Fatalf("seed: %v", err)
+			}
+
+			now := time.UnixMilli(4_000_000)
+			f := &fakeFetcher{body: asuraSeriesFixture, status: 200}
+			newTestPoller(t, s, f, now).checkOne(context.Background(), Bookmark{
+				Key: key, Site: tt.site, SeriesURL: tt.seriesURL,
+			})
+
+			if got := f.callCount(); got != tt.wantCalls {
+				t.Fatalf("fetch calls = %d, want %d", got, tt.wantCalls)
+			}
+			if got := readLatestCheckedAt(t, s, key); got != now.UnixMilli() {
+				t.Fatalf("latest_checked_at = %d, want %d (cooldown must be consumed regardless)", got, now.UnixMilli())
+			}
+		})
+	}
+}
+
 // A cancelled context must abandon the batch rather than run it to completion.
 func TestRunOnceStopsOnCancelledContext(t *testing.T) {
 	s := newTestStore(t)